16577 matches found
BIT-OAUTH2-PROXY-2025-64484 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashe...
CVE-2025-12998 Broken Authentication in extension “Modules” (modules)
Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5...
CVE-2025-61623 Apache OFBiz: Reflected Cross-site Scripting
Reflected cross-site scripting vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.03. Users are recommended to upgrade to version 24.09.03, which fixes the issue...
CVE-2025-11962
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS. This issue affects Digital Corporate Warehouse: before v.4.8.2.22...
CVE-2025-54983
A health check port on Zscaler Client Connector on Windows, versions 4.6 4.6.0.216 and 4.7 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls...
CVE-2025-42940
SAP CommonCryptoLib does not perform necessary boundary checks during pre-authentication parsing of manipulated ASN.1 data over the network. This may result in memory corruption followed by an application crash, hence leading to a high impact on availability. There is no impact on confidentiality...
PT-2025-46679
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.0.1, 9.4.5, 9.3.7, and 9.2.9 Splunk Cloud Platform versions prior to 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121 Description An unauthenticated attacker could construct a malicious URL utilizing the retur...
CVE-2025-63353: Improper Access Control
A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password WPA/WPA2 pre-shared key to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an...
Fujitsu BIOS Driver 缓冲区错误漏洞
Fujitsu BIOS Driver is a system driver from Fujitsu Japan. A buffer error vulnerability exists in Fujitsu BIOS Driver versions prior to 2.5.0.0, which stems from a lack of sufficient validation of inputs, and could allow an attacker to compromise the confidentiality, integrity, and availability o...
Symfony 安全漏洞
Symfony is a PHP framework for web and console applications and a set of reusable PHP components from Symfony, Inc. A security vulnerability exists in Symfony versions prior to 5.4.50, 6.4.29, and 7.3.7, which stems from improper parsing of PATHINFO and could lead to bypassing access control rule...
EulerOS 2.0 SP10 : aide (EulerOS-SA-2025-2405)
According to the versions of the aide package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An...
CVE-2025-11578
A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker...
CVE-2025-64509
Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service. This can be done if the DSN is known, which it is in many common setups JavaScript...
EUVD-2025-84334
Spoofing issue in Firefox. This vulnerability affects Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30...
CVE-2025-32088
Improper conditions check for some IntelR QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially...
CVE-2025-30182
Uncontrolled search path for some IntelR Distribution for Python software installers before version 2025.2.0 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalati...
CVE-2025-35967
Intel PROSet/Wireless WiFi Software for Windows before version 23.160 contains an out-of-bounds read in Ring 2 device drivers that may allow a denial of service. An unprivileged, unauthenticated attacker with low complexity and adjacent access, requiring no user interaction, could impact availabi...
CVE-2025-32732
Summary (CVE-2025-32732): Intel® QuickAssist Technology (QAT) Windows software pre-2.6.0 is vulnerable to a buffer overflow in the Ring 3 user application, which can be exploited by a local, authenticated, low-complexity attacker to cause a denial of service. Impacts may include low confidentiali...
CVE-2025-27725
CVE-2025-27725 describes a time-of-check time-of-use race condition in Intel ACAT (Assistive Context-Aware Toolkit) software before version 3.13, impacting Ring 3 user applications. The root cause is a race in the user-space component that can allow a local, authenticated, low-privilege attacker ...